Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Dahua device users
Incident: Operation CameraSwarm compromised over 14,500 Dahua cameras via authentication bypasses and P2P relays.
Impact: Unauthorized access to surveillance feeds and the installation of persistent backdoor accounts.
Attacker: Unidentified threat actors (Operation CameraSwarm)
Analysis: Threat actors utilized a multi-vector approach combining credential stuffing, P2P relay techniques, and critical authentication-bypass vulnerabilities. The campaign specifically targeted devices in Ukraine and Russia, with some attackers establishing persistent accounts that survive factory resets. The exploitation of CVE-2021-33044 and CVE-2021-33045 highlights the ongoing risk posed by unpatched legacy IoT hardware.
Recommendations: Update all Dahua devices to the latest vendor-supplied firmware immediately.; Disable P2P functionality on all cameras where it is not strictly required.; Review device administrative accounts for any unauthorized or unknown users.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source